CVE-2025-11355
Published: 07 October 2025
Summary
CVE-2025-11355 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 1250Gw Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-11355 is a buffer overflow vulnerability in UTT 1250GW routers up to version v2v3.2.2-200710. The flaw affects the strcpy function in the /goform/aspChangeChannel file, triggered by manipulation of the pvid argument. It is classified under CWE-119 and CWE-120, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction. Exploitation leads to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system compromise.
Advisories from VulDB indicate that a proof-of-concept exploit has been publicly disclosed on GitHub, and the vendor was contacted early but provided no response. No patches or official mitigations are referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-32106
Vulnerability details
A vulnerability has been found in UTT 1250GW up to v2v3.2.2-200710. Affected by this vulnerability is the function strcpy of the file /goform/aspChangeChannel. The manipulation of the argument pvid leads to buffer overflow. It is possible to initiate the attack…
more
remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web interface (/goform/aspChangeChannel) enables remote exploitation (AV:N/PR:L) for arbitrary code execution, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the pvid argument to prevent buffer overflow from malicious input manipulation in the strcpy function.
Mandates timely flaw remediation for known vulnerabilities like this buffer overflow, including patching or vendor updates despite lack of response.
Implements memory protections such as stack canaries or non-executable memory to mitigate exploitation of the buffer overflow even if input validation fails.